CVE-2017-7794

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-276

Description

On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. Note: This attack only affects the Linux operating system. Other operating systems are not affected. This vulnerability affects Firefox < 55.

Affected products

Mozilla Firefox: before 55.0 — fixed in 55.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 55.0. Check the vendor advisory for mitigations.

References

http://www.securitytracker.com/id/1039124
https://bugzilla.mozilla.org/show_bug.cgi?id=1374281
https://www.mozilla.org/security/advisories/mfsa2017-18/
http://www.securitytracker.com/id/1039124
https://bugzilla.mozilla.org/show_bug.cgi?id=1374281
https://www.mozilla.org/security/advisories/mfsa2017-18/

Get alerted when CVE-2017-7794 or the next vulnerability affects your stack